commit 624981438d5b6ae90d500394102b220c52b1f04c
author rago <rago@google.com> Tue Sep 20 00:46:10 2016 +0000
committer android-build-merger <android-build-merger@google.com> Tue Sep 20 00:46:10 2016 +0000
tree 10a50969f457f2d5145cd8bc0745f306bc6bf0e1
parent 540acb3db529d10fd891c0d61086b1d78ef575c4
parent 38dcbab6b3b1efb2a953db3b8394a78875a7510c

Fix potential overflow in Visualizer effect am: 57ac66340a am: 63a995164c
am: 38dcbab6b3

Change-Id: Ic3eb9a21798bbf80c31aa1c6da534f11978685a5

visualizer/offload_visualizer.c

diff --git a/visualizer/offload_visualizer.c b/visualizer/offload_visualizer.c
index 9b11e20..3231f47 100644
--- a/visualizer/offload_visualizer.c
+++ b/visualizer/offload_visualizer.c
@@ -841,6 +841,14 @@
         break;
 
     case VISUALIZER_CMD_MEASURE: {
+        if (pReplyData == NULL || replySize == NULL ||
+                *replySize < (sizeof(int32_t) * MEASUREMENT_COUNT)) {
+            ALOGV("%s VISUALIZER_CMD_MEASURE error *replySize %d <"
+                    "(sizeof(int32_t) * MEASUREMENT_COUNT) %d",
+                    __func__, *replySize, sizeof(int32_t) * MEASUREMENT_COUNT);
+            android_errorWriteLog(0x534e4554, "30229821");
+            return -EINVAL;
+        }
         uint16_t peak_u16 = 0;
         float sum_rms_squared = 0.0f;
         uint8_t nb_valid_meas = 0;